search menu icon-carat-right cmu-wordmark

Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection

Technical Note
In this report, the authors present methods for detecting and preventing data exfiltration using a Linux-based proxy server in a Microsoft Windows environment.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2013-TN-012
DOI (Digital Object Identifier)
10.1184/R1/6573095.v1

Abstract

Web-based services, such as email, are useful for communicating with others either within or outside of an organization; however, they are a common threat vector through which data exfiltration can occur. Despite this risk, many organizations permit the use of web-based services on their systems. Implementing a method to detect and prevent data exfiltration through these channels is essential to protect an organization's sensitive documents.

This report presents methods that can be used to detect and prevent data exfiltration using a Linux-based proxy server in a Microsoft Windows environment. Tools such as Squid Proxy, Clam Antivirus, and C-ICAP are explored as means by which information technology (IT) professionals can centrally log and monitor web-based services on Microsoft Windows hosts within an organization. Also introduced is a Tagger tool developed by the CERT Insider Threat Center that enables information security personnel to quickly insert tags into documents. These tags can then be used to create signatures for use on the proxy server to prevent documents from leaving the organization. In addition, the use of audit logs is also explored as an aid in determining whether sensitive data may have been uploaded to an internet service by a malicious insider.

Cite This Technical Note

Silowash, G., Lewellen, T., Burns, J., & Costa, D. (2013, March 1). Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection. (Technical Note CMU/SEI-2013-TN-012). Retrieved April 13, 2024, from https://doi.org/10.1184/R1/6573095.v1.

@techreport{silowash_2013,
author={Silowash, George and Lewellen, Todd and Burns, Joshua and Costa, Daniel},
title={Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection},
month={Mar},
year={2013},
number={CMU/SEI-2013-TN-012},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6573095.v1},
note={Accessed: 2024-Apr-13}
}

Silowash, George, Todd Lewellen, Joshua Burns, and Daniel Costa. "Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection." (CMU/SEI-2013-TN-012). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, March 1, 2013. https://doi.org/10.1184/R1/6573095.v1.

G. Silowash, T. Lewellen, J. Burns, and D. Costa, "Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Note CMU/SEI-2013-TN-012, 1-Mar-2013 [Online]. Available: https://doi.org/10.1184/R1/6573095.v1. [Accessed: 13-Apr-2024].

Silowash, George, Todd Lewellen, Joshua Burns, and Daniel Costa. "Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection." (Technical Note CMU/SEI-2013-TN-012). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Mar. 2013. https://doi.org/10.1184/R1/6573095.v1. Accessed 13 Apr. 2024.

Silowash, George; Lewellen, Todd; Burns, Joshua; & Costa, Daniel. Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection. CMU/SEI-2013-TN-012. Software Engineering Institute. 2013. https://doi.org/10.1184/R1/6573095.v1